Zensoul
Monthly
PHP object injection through deserialization of untrusted data affects the ThemeREX ZenSoul WordPress theme at all versions through 1.13, exposed over the network with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) per the supplied vector. The available sources do not identify the specific endpoint, parameter, or theme feature that reaches the unsafe deserialization, nor whether a usable POP gadget chain exists in the theme, WordPress core, or installed plugins - a factor that typically governs whether object injection escalates to code execution, file operations, or data disclosure. No confirmation of active exploitation (CISA KEV) or verified working exploit code was provided; a public reference exists at the Patchstack vulnerability database entry, and the site's priority label is act_now.
PHP object injection through deserialization of untrusted data affects the ThemeREX ZenSoul WordPress theme at all versions through 1.13, exposed over the network with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) per the supplied vector. The available sources do not identify the specific endpoint, parameter, or theme feature that reaches the unsafe deserialization, nor whether a usable POP gadget chain exists in the theme, WordPress core, or installed plugins - a factor that typically governs whether object injection escalates to code execution, file operations, or data disclosure. No confirmation of active exploitation (CISA KEV) or verified working exploit code was provided; a public reference exists at the Patchstack vulnerability database entry, and the site's priority label is act_now.